AIKIDO-2026-10371

TL;DR

Affected versions of @sentry/sveltekit use an existsSync(mapFile) check before reading and writing source map files during the SvelteKit build (in closeBundle). Between the time-of-check and time-of-use, the file system can change (e.g. file removed or replaced), causing a time-of-check-time-of-use (TOCTOU) race. A local attacker with control over the build environment could exploit this to influence which file is read or written, potentially leaking build artifacts or corrupting outputs. The patch removes the existsSync guard and wraps the read and write in a try/catch so that missing or changed files are handled without relying on a prior check.